Aircraft: A320
Phase of flight: Cruise
Anomaly: Deviation - Speed All Types; Flight Deck / Cabin / Aircraft Event Illness / Injury; Inflight Event / Encounter Weather / Turbulence

We were operating Aircraft X to ZZZ. We were in cruise at 21;000 in clear air; with smooth flight conditions and no restrictions to visibility. The seatbelt sign was off. With no indications or reports of turbulence at our altitude; we suddenly encountered Moderate to Severe turbulence. The aircraft oversped by 3-5 knots and the autopilot disconnected. I was the pilot flying and immediately took control of the aircraft. The turbulence action plan was immediately initiated. The Captain turned on the fasten seatbelt sign and immediately made a PA for the flight attendants to be seated immediately. We then requested a descent to 18;000 and the ride improved as we passed through 20;000. The Captain then had the flight attendants check in where we were notified of two possible passenger injuries. One was to a woman in the Lav who hit her head on the door but stated that she was fine. A male passenger reported hitting his knee on a galley cart. He requested ice and said he was fine. The Captain initiated contact with dispatch and Medlink and requested that paramedics meet the airplane upon arrival in ZZZ. The rest of the flight was uneventful. On taxi in; the lead Flight Attendant called to inform us that another male passenger was complaining of back pain. We arrived at the gate; shut down; and the paramedics were there to offer assistance to the injured passengers. Level at 21;000; CNOTA intersection. Ride went from smooth to moderate/severe turbulence in 5 seconds or less. Used Turbulence [report] commands. When Purser checked in with me; she had reports from two passengers that had been mildly injured (one in lavatory bumped head; one standing in aisle hurt knee). Approaching top of descent into ZZZ another passenger reported a hurt back; this passenger would go to the hospital for evaluation. While the first two passengers did not request medical attention; my FO (First Officer) and I agreed that with two injuries we would go ahead and have medical assistance meet the aircraft. Filed a PIREP through ACARS; notified Dispatch who correctly suggested MedLink as backup. With nothing more than mild injuries; we continued to ZZZ. Further info: There was turbulence forecast 5000 feet above us; and ATC did report that we would not like the ride higher but nothing worse than light at our altitude. Our dispatcher mentioned it in the release; and filed us lower to stay out of it. I even commented when accepting the release that I had been thinking the same thing. We were completely not expecting what happened. Purser informed us later that the aft flight attendants had just gotten the cart to the front of coach to start their service. Quite frankly; we're lucky more weren't injured. My 5 seconds or less estimate above for turbulence onset is likely long with time dilation in the heat of the moment. In my 25 years I've never seen turbulence hit so hard; so fast; with nothing forecast or reported in the vicinity. There wasn't time to get the seat belt sign on - and indeed I forgot it until I heard our Purser make a PA for the passengers to fasten their seat belts. I'm usually the one that would rather call MedLink proactively. This time; I did not due to my perception that nobody was really injured. I was clearly wrong here. Finally - I'll admit that I've rolled my eyes a bit at the Turbulence [report]. I still think we are a little over-sensitive to light turbulence; this trains the passengers that the seat belt sign doesn't signal that it's not safe to move around. However - the Turbulence [report] was perfect for this event. Perfect. The commands were excellent; and I was glad to have the guide; the training; and the shared language for what needed to happen in the flight deck and the cabin. I'll go ahead and say it: I was wrong. A320 flight crew reported unexpected severe turbulence; resulting in passenger injuries.